e22b39312f274bf684df96d1a69a0132987bef5dd97ad459cfe963f261dcf4e4

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/10/2023, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/HWID_Activation.cmd
Size

54KB
MD5

7ddb1766a6574fd10e29303e24272ad1
SHA1

c91185a98353e64ebd4707e26fbbffa5d4d7e7c3
SHA256

005f28b334a8f0bc0b611a616e6558127d21dfec43a163ed4536c2bb46477ef9
SHA512

756b28a6787dc2de0d0372901982d4c384a02cf5517aa944ed2cbb2cebd23c172200f9220faf725b089ea97c8f81c878cd7e602a73b8721c1f89114ebe03549f
SSDEEP

768:h2zZiOKJ5yorr997+3YWSWMxahF438mpr8Fp9lvCRdi5NEjS+C7S4jFh0z1E6yfH:oi3yg2MxMMUflsdi54Em0Iy6yP4Nm36s

Score

4^/10

Malware Config

Signatures

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1716	sc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2260	powershell.exe
2764	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1716	752	cmd.exe	29
PID 752 wrote to memory of 1716	752	cmd.exe	29
PID 752 wrote to memory of 1716	752	cmd.exe	29
PID 752 wrote to memory of 2064	752	cmd.exe	30
PID 752 wrote to memory of 2064	752	cmd.exe	30
PID 752 wrote to memory of 2064	752	cmd.exe	30
PID 752 wrote to memory of 2124	752	cmd.exe	31
PID 752 wrote to memory of 2124	752	cmd.exe	31
PID 752 wrote to memory of 2124	752	cmd.exe	31
PID 752 wrote to memory of 2348	752	cmd.exe	32
PID 752 wrote to memory of 2348	752	cmd.exe	32
PID 752 wrote to memory of 2348	752	cmd.exe	32
PID 752 wrote to memory of 2260	752	cmd.exe	33
PID 752 wrote to memory of 2260	752	cmd.exe	33
PID 752 wrote to memory of 2260	752	cmd.exe	33
PID 752 wrote to memory of 2764	752	cmd.exe	34
PID 752 wrote to memory of 2764	752	cmd.exe	34
PID 752 wrote to memory of 2764	752	cmd.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Activators\HWID_Activation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:1716
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2064
- C:\Windows\System32\findstr.exe
  findstr /v "$" "HWID_Activation.cmd"
  2⤵
  PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe write-host -back '"Red"' -fore '"white"' '"==== ERROR ===="'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe write-host -back '"Black"' -fore '"Yellow"' '"Press any key to Exit..."'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
d340f3b2c08a61a38be92d906a1f4fd3

SHA1
0709279754099f93cde78ee68628e9faad294c03

SHA256
316ef677c433f4db5920e8166526189513755e17aeac29006033ba48e1576a1e

SHA512
059ba31496feb31f8271d5e2e7032ea283c36470c386857a2d98130e6ac835108b8aab05928fc1b7f8982d9605f81a080d602f5705a325c4466eeabbeac68628

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WHYXCIW05P0TDA9R9AT1.temp

Filesize
7KB

MD5
d340f3b2c08a61a38be92d906a1f4fd3

SHA1
0709279754099f93cde78ee68628e9faad294c03

SHA256
316ef677c433f4db5920e8166526189513755e17aeac29006033ba48e1576a1e

SHA512
059ba31496feb31f8271d5e2e7032ea283c36470c386857a2d98130e6ac835108b8aab05928fc1b7f8982d9605f81a080d602f5705a325c4466eeabbeac68628

Download Submit
memory/2260-8-0x0000000002A10000-0x0000000002A90000-memory.dmp

Filesize
512KB

Download
memory/2260-5-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp

Filesize
9.6MB

Download
memory/2260-4-0x000000001B340000-0x000000001B622000-memory.dmp

Filesize
2.9MB

Download
memory/2260-9-0x0000000002A10000-0x0000000002A90000-memory.dmp

Filesize
512KB

Download
memory/2260-10-0x0000000002A10000-0x0000000002A90000-memory.dmp

Filesize
512KB

Download
memory/2260-11-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp

Filesize
9.6MB

Download
memory/2260-6-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/2260-7-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-17-0x000000001B250000-0x000000001B532000-memory.dmp

Filesize
2.9MB

Download
memory/2764-19-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/2764-20-0x0000000002B00000-0x0000000002B80000-memory.dmp

Filesize
512KB

Download
memory/2764-18-0x000007FEF50D0000-0x000007FEF5A6D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-21-0x0000000002B00000-0x0000000002B80000-memory.dmp

Filesize
512KB

Download
memory/2764-22-0x000007FEF50D0000-0x000007FEF5A6D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-23-0x0000000002B0B000-0x0000000002B72000-memory.dmp

Filesize
412KB

Download
memory/2764-24-0x000007FEF50D0000-0x000007FEF5A6D000-memory.dmp

Filesize
9.6MB

Download